dcavalca / rpms / qemu

Forked from rpms/qemu a year ago
Clone

Blame 0001-aio-posix-don-t-duplicate-fd-handler-deletion-in-fdm.patch

3da886
From: Stefan Hajnoczi <stefanha@redhat.com>
3da886
Date: Mon, 11 May 2020 19:36:29 +0100
3da886
Subject: [PATCH] aio-posix: don't duplicate fd handler deletion in
3da886
 fdmon_io_uring_destroy()
3da886
3da886
The io_uring file descriptor monitoring implementation has an internal
3da886
list of fd handlers that are pending submission to io_uring.
3da886
fdmon_io_uring_destroy() deletes all fd handlers on the list.
3da886
3da886
Don't delete fd handlers directly in fdmon_io_uring_destroy() for two
3da886
reasons:
3da886
1. This duplicates the aio-posix.c AioHandler deletion code and could
3da886
   become outdated if the struct changes.
3da886
2. Only handlers with the FDMON_IO_URING_REMOVE flag set are safe to
3da886
   remove. If the flag is not set then something still has a pointer to
3da886
   the fd handler. Let aio-posix.c and its user worry about that. In
3da886
   practice this isn't an issue because fdmon_io_uring_destroy() is only
3da886
   called when shutting down so all users have removed their fd
3da886
   handlers, but the next patch will need this!
3da886
3da886
Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com>
3da886
---
3da886
 util/aio-posix.c      |  1 +
3da886
 util/fdmon-io_uring.c | 13 ++++++++++---
3da886
 2 files changed, 11 insertions(+), 3 deletions(-)
3da886
3da886
diff --git a/util/aio-posix.c b/util/aio-posix.c
3da886
index c3613d299e..8af334ab19 100644
3da886
--- a/util/aio-posix.c
3da886
+++ b/util/aio-posix.c
3da886
@@ -679,6 +679,7 @@ void aio_context_destroy(AioContext *ctx)
3da886
 {
3da886
     fdmon_io_uring_destroy(ctx);
3da886
     fdmon_epoll_disable(ctx);
3da886
+    aio_free_deleted_handlers(ctx);
3da886
 }
3da886
 
3da886
 void aio_context_set_poll_params(AioContext *ctx, int64_t max_ns,
3da886
diff --git a/util/fdmon-io_uring.c b/util/fdmon-io_uring.c
3da886
index d5a80ed6fb..1d14177df0 100644
3da886
--- a/util/fdmon-io_uring.c
3da886
+++ b/util/fdmon-io_uring.c
3da886
@@ -342,11 +342,18 @@ void fdmon_io_uring_destroy(AioContext *ctx)
3da886
 
3da886
         io_uring_queue_exit(&ctx->fdmon_io_uring);
3da886
 
3da886
-        /* No need to submit these anymore, just free them. */
3da886
+        /* Move handlers due to be removed onto the deleted list */
3da886
         while ((node = QSLIST_FIRST_RCU(&ctx->submit_list))) {
3da886
+            unsigned flags = atomic_fetch_and(&node->flags,
3da886
+                    ~(FDMON_IO_URING_PENDING |
3da886
+                      FDMON_IO_URING_ADD |
3da886
+                      FDMON_IO_URING_REMOVE));
3da886
+
3da886
+            if (flags & FDMON_IO_URING_REMOVE) {
3da886
+                QLIST_INSERT_HEAD_RCU(&ctx->deleted_aio_handlers, node, node_deleted);
3da886
+            }
3da886
+
3da886
             QSLIST_REMOVE_HEAD_RCU(&ctx->submit_list, node_submitted);
3da886
-            QLIST_REMOVE(node, node);
3da886
-            g_free(node);
3da886
         }
3da886
 
3da886
         ctx->fdmon_ops = &fdmon_poll_ops;